Align Core 0.7 schemas, negative interop and three-platform install verification (0.7.5)

[schchit]

Changes

• Require nonempty extension identifiers and whole-string digest matches in current schemas; no frozen specification or signed fixture is changed.
• Add 25 real-signature input cases across Core/API/Agent archival and acceptance modes, including unchanged hashes, diagnostic categories, non-consuming rejection, corrected same-identity acceptance and safe retry.
• Pin the gate to paired fixes Fix Core 0.7 input boundaries before acceptance (0.8.5) jep-api#15 and Harden current JWS encoding and complete local verification path (2.1.6) jep-agent-sdk#15. Retain existing signed transport, Binding/02 and historical pins.
• Surface the no-API Agent SDK example separately from HTTP Quickstart.
• Expand published-baseline install verification to Linux/Windows/macOS. Add a post-PyPI job that explicitly selects the coordinated new release versions; it does not mistake old registry bytes for candidate validation.

Evidence

Local selected Core suites: 79 passed, 1 skipped. Actual-source cross-implementation input gate: 25 cases / 0 failures, versus 14 inconsistent cases before fixes. check_repository.py verifies frozen -07 hashes and current/legacy vector boundaries unchanged. Full hosted CI, cross-repository transport and the three-platform baseline install jobs must pass before merging.

Release dependency order

API 0.8.5 and Agent SDK 2.1.6 must publish before Core 0.7.5. PR install checks deliberately use the already published 0.7.4/2.1.5 baseline; the post-publication --current-release job checks 0.7.5/2.1.6 plus API 0.8.5. Production hosting and npm authorization remain separate owner configuration.

Expected code tree: 0b09e6e560ea902da877c58606f893a01b0739ac. No Prooftask, secrets, production state, frozen drafts or historical signed artifacts were modified.